How does 'mtn testresult' work?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello everybody,

while trying to figure out, how 'mtn testresult' works, I did the
following:

- ----- 8< -----
mkdir tmp
cd tmp
echo -e '\n\n'|mtn --keydir keys genkey testkey1
echo -e '\n\n'|mtn --keydir keys genkey testkey2
mtn --db test.mtn db init
mtn --db test.mtn --keydir keys --branch testbranch setup testbranch1
cd testbranch1
echo abc > testfile
mtn add testfile
mtn commit -m Initial -k testkey1
mtn -k testkey2 testresult 99b505974f54aa4d0344b597362791590fd85028 pass
cd ..
mtn --db test.mtn --keydir keys --branch testbranch co testbranch2
cd testbranch1
echo def >> testfile
mtn commit -m Second -k testkey1
mtn -k testkey2 testresult a4bd7c92fca04dd92e10175fa6bd300ebe0531e4 fail
cd ../testbranch2
echo testkey2 > _MTN/wanted-testresults
mtn update
- ----- >8 -----

I did expect that the last 'mtn update' would fail, since the first
revision (99b505..) now contains a cert with name 'testresult' signed
by testkey2 and value '1' while the second revision (a4bd7c..) has the
same cert but with value '0'.

Maybe I did not understand the meaning of
http://www.monotone.ca/docs/Quality-Assurance.html and
http://www.monotone.ca/docs/Trust-Evaluation-Hooks.html

Regards,

Mathias
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (GNU/Linux)
Comment: Using GnuPG with undefined - http://www.enigmail.net/

iEYEARECAAYFAlDUIUkACgkQIjqrn1X6XoxurQCgkRBguM+0JUeCuiL3BkT5qXYD
e94AoI+qZ8KOJiY2DweSMvCpv+snWyUv
=Djab
-----END PGP SIGNATURE-----